Feeds

MS struggles to contain the Slammer worm

: The worm that turned

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

MemoWatch An insight into the problems faced by Microsoft indealing with the Slammer (aka Sapphire) worm is revealed in internal company memos leaked to El Reg.

The email memos from Microsoft security team (18 in all of which we publish only the first [most illuminating] four) reveal a giant corporation struggling to contain the effects of a virulent worm, which knocked many of its Internet services offline.

Those who blame system admins for the spread of the worm might do well to ponder on the fact even Microsoft had not applied its fix which, it's now clear, was far from easy to apply.



From: Mike Carlson (ITG)


Sent: Saturday, January 25, 2003 8:04 AM


To: EIS Data Center Clients; uDRM Operations Team; Gregory Wood's Direct


Reports; IR/ID


Cc: HUSK:Corporate Data Center Release Management; ITG DR Command Team; ITG DR Functional Command Team; Randy Coggan; Jim DuBois Direct Reports; Steven Rees

< Microsoft Confidential - Do Not Forward! >

Event Description:

At approx 10:00 pm traffic on the corporate network jumped dramatically, eventually bringing nearly all services to a crawl. The root cause appears at this time to be a virus attacking SQL servers on UDP port 1434. The problem is not confined to MS only, as there are reports of widespread impact at other companies and across the Internet.

Start Date/Time:

Approximately 10:00 PM PST, Friday 1/24/2003.

Impact:

All apps and services are potentially affected and performance is sporadic as best. The network is essentially flooded with traffic, making it difficult to gather details concerning the impact.

Status Update:

Confirmed SQL SP3 does protect the system from the virus, but believe we may have a hot fix that could be remotely applied to SP2 as well. All systems owners should make plans to update their systems asap.

ETA: None.

Action Required:

Owners should be planning to upgrade their systems asap.

Next Update: 0900



From: Mike DeGooyer


Sent: Saturday, January 25, 2003 9:15 AM


To: EIS Data Center Clients; Gregory Wood's Direct Reports; IR/ID


Cc: Broadband Networking All; Corporate Data Center Release Management; ITG


DR Command Team; ITG DR Functional Command Team; Randy Coggan; Jim DuBois Direct Reports; Steven Rees



Microsoft Confidential

Do Not Forward

Corporate Network Outage: 1-24-03

Update: Network traffic is still affected and inhibiting traffic. Effected resources have been identified and operations is isolating network traffic to apply the fix upon completion.

Next Update: 1000 PST or when implementation steps are ready.

Action Required:

None at this time. Effected resources owners will be contacted.

Description:

At approximately 10:00pm PST traffic on the corporate network increased dramatically due to a virus attack directed at SQL Server. The interruption was not directed at Microsoft Resources.

Event Summary:

8:00am Specific file versions and server impact is being assessed.

7:00am Engineering testing application of hot fix that could be remotely applied to SP2.

6:00am Engineering confirmed SQL SP3 protects systems. Preparing to engage effected server owners.

5:00am Identifying that patch that will fully protect the systems.

4:00am Virus behavior was identified. Working on resolution process.

3:00am SQL Dev and engineering are engaged isolating the issue.

2:00am Engineering engaged to isolate the issue and behavior patterns.

1:16am Notification sent clients.

____________

Mike DeGooyer
EIS Release Management- BGIT

[contact details deleted]



From: Mike DeGooyer


Sent: Saturday, January 25, 2003 11:23 AM


To: Mike DeGooyer; EIS Data Center Clients; Gregory Wood's Direct Reports;


IR/ID


Cc: Broadband Networking All; Corporate Data Center Release Management; ITG


DR Command Team; ITG DR Functional Command Team; Randy Coggan; Jim DuBois Direct Reports; Steven Rees; uDRM Operations (MSE); Corporate Data Center Release Management



Update: HELP NEEDED: If you have servers that are nonessential, please shut down the MSSQLSERVER service as well as SQL Agent (so SQL doesn't restart) so that we can eliminate nonessential noise/traffic on the network. Your urgent assistance with this will be very helpful.

SQL Development and Engineering are engaged. Network traffic is still affected and inhibiting traffic. Operations are isolating network traffic to apply the fix upon completion.

Next Update: 1200 PST or when implementation steps are ready.

____________

Mike DeGooyer

EIS Release Management- BGIT

[contact details deleted]



From: Chad Lewis


Sent: Saturday, January 25, 2003 12:35 PM


To: EIS Data Center Clients; Gregory Wood's Direct Reports; IR/ID; ITG DR


Command Team; ITG DR Functional Command Team


Cc: Broadband Networking All; Corporate Data Center Release Management;


Randy Coggan; Jim DuBois Direct Reports; Steven Rees; uDRM Operations


(MSE); Phil Nguyen (ITG); Mike DeGooyer; Building 11 MCSS Members; TK MCSS


Staff; Jim Pauley; Global Networks Operations Center; Steven Rees; Paul


Olson; Peter Tutak; MSN IA Core



**Microsoft Confidential - Do Not Forward!**

Status Update:

If you have SQL servers that are nonessential, please shut down the MSSQLSERVER service as well as SQL Agent (so SQL does not restart) so that we can eliminate nonessential noise/traffic on the network. Your urgent assistance is required.

Within the next 60 minutes, the 039 SQL patch will be scripted for deployment to all SQL servers outside the data center to reduce traffic volume on the network. For details on 039, visit
www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp.
Impact will be a cycling of the SQL service.

We are investigating the best method of addressing the data center space and will communicate during next update.

Next update 1:30pm, or as needed.

Chad Lewis

EIS Release Management




By Monday morning (the time of the last memo sent to us) Microsoft had more or less got on top of the problem but reported it continued to "monitor client traffic volumes and corporate network impacts" caused by the worm.

All this disruption, which was also felt by banks, ISPs and other organisation, was preventable with a six-month old patch. But if Microsoft doesn't apply its own fixes what chance do the rest of us have? ®

Related Stories

ATMs, ISPs hit by Slammer worm spread
SQL worm slams the Net

External Links

SQL Slammer worm advisory by security tools firm ISS
More on the SQL Server 2000 vulnerability Slammer exploits, alert by Next Generation Security Software

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.